CAS-004 Security Architecture Practice Question
A company uses Kubernetes for container orchestration. Which security control should be implemented to enforce that only specific images from a trusted registry can run in the cluster?
⚠ Common exam trap
CAS-005 often tests Kubernetes security controls by presenting several plausible-sounding controls (PSA, Network Policies, RBAC), so candidates who see 'only specific images' and pick PSA or RBAC miss that image provenance requires an admission controller with policy logic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Admission controller (e.g., OPA/Gatekeeper)
An admission controller such as OPA/Gatekeeper intercepts API server requests before objects are persisted and can enforce policies — including image registry allow-lists — so only images from trusted registries are admitted to the cluster. Gatekeeper's ConstraintTemplates and Constraints let you write Rego policies that validate image fields in Pod specs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pod security admission (PSA)
Why it's wrong here
Pod security admission governs pod-level settings such as privileged mode, host namespaces and capabilities, not image provenance. It cannot verify which registry an image originates from. PSA is the right control when restricting pod privilege and hardening workloads, but enforcing trusted-registry-only images requires an admission policy that validates image references, such as a validating admission controller.
- ✓
Admission controller (e.g., OPA/Gatekeeper)
Why this is correct
An admission controller intercepts pod creation requests before persistence and evaluates them against policy. OPA/Gatekeeper enforces rules restricting image sources, so only images from the trusted registry are admitted, directly satisfying the stem's trusted-registry constraint.
- ✗
Network policies
Why it's wrong here
Network policies filter pod-to-pod traffic at layers 3 and 4, so they cannot inspect image provenance or block a pod from pulling an untrusted image. They are tempting because they genuinely restrict lateral movement and egress between namespaces, which is the right control when the requirement is segmenting workload communication rather than governing image sources.
- ✗
RBAC roles
Why it's wrong here
RBAC roles govern which users or service accounts may perform actions on cluster resources, not which image registries pods may pull from. It is tempting because RBAC genuinely restricts who can create or modify workloads, and would be correct for limiting namespace access or preventing unauthorised deployments — but image provenance requires admission control.
Go deeper
Related to this question
About these practice questions
One of 973 original CAS-005 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.